Table Of ContentServer Administrator Guide
TheServerAdministratorGuideisyourcompletereferenceforhandlingadministrativetaskson
TableauServer.
-1-
Before you install...
Note: YoucanfindadditionalinformationabouttechnicalspecificationsforTableau
ServerontheTableauwebsite,here.
Makesurethecomputeronwhichyou’reinstallingTableauServermeetsthefollowing
requirements:
Supported operating systems—TableauServerisavailableina64-bitversion.You
l
caninstallTableauServeronWindowsServer2008R2,WindowsServer2012,Windows
Server2012R2,Windows7,Windows8,Windows8.1,orWindows10.Youmayinstall
TableauServeronvirtualorphysicalplatforms.
Supported browsers—TableauServer10supportsInternetExplorer11innative
l
mode,andthelatestversionsofChrome,Firefox,andSafari.
Thishaspotentialtoimpact:
CustomersinstallingTableauServerforthefirsttimeonWindows8orWindows
l
Server2012(non-R2).Formoreinformation,seeInternetExplorerSupport.
CustomersaccessingembeddedTableauviewsinwebpagesthatforceInternet
l
Explorerintocompatibilitymode.Formoreinformation,seeInternetExplorer
CompatibilityMode.
Minimumrequirements—ThecomputeryouinstallTableauServeronmustmeetor
l
exceedtheminimumhardwarerequirements.TableauServerwillnotinstallifyour
computerdoesnotmeettheminimumrequirements.
Minimumrequirementsareappropriatefortestingandprototyping.
l
Forproductionenvironmentsyourcomputersshouldmeetorexceedthe
l
minimumrecommendations.
Formoreinformation,seeMinimumHardwareRequirementsand
Recommendationsfor Tableau Serveronpage 106.
Administrativeaccount—TheaccountunderwhichyouinstallTableauServermust
l
havepermissiontoinstallsoftwareandservices.
Optional: Run AsAccount—ARunAsUseraccountfortheTableauServerserviceto
l
rununderisusefulifyou’reusingNTAuthenticationwithdatasourcesorifyou’re
planningondoingSQLServerimpersonation.Formoreinformation,seeRun AsUser
onpage 9andSQL Server Impersonationonpage 474.
IIS and port 80—TableauServer'sgatewaylistensonport80,whichisalsousedby
l
InternetInformationServices(IIS)bydefault.IfyouareinstallingTableauServerona
machinethat'salsorunningIIS,youshouldmodifytheTableau'sgatewayportnumberto
-2-
avoidconflictwithIIS.SeeTableau Server Portsonpage 676andEdit theDefault
Portsonpage 30fordetails.
StaticIP addresses—AnycomputerrunningTableauServer,whetherit'sasingle
l
serverinstallationorpartofacluster,musthaveastaticIPaddress.Formore
information,seeHostnameSupport in Tableau Serveronpage 130.
Configuration Information
WhenyouinstallandconfigureTableauServeryoumaybeaskedforthefollowinginformation:
Option Description Your Information
Server Theservermusthaveauseraccountthattheservice Username:
Account canuse.Thedefaultisthebuilt-inWindowsNetwork
Password:
Serviceaccount.Ifyouuseaspecificuseraccount
you’llneedthedomainname,username,andpass- Domain:
word.
ActiveDir- InsteadofusingTableau’sbuilt-inusermanagement ActiveDirectory
ectory system,youcanauthenticatethroughActiveDir- Domain:
ectory.Ifso,you’llneedthefully-qualifieddomain
name.
Openportin WhenselectedTableauServerwillopentheportused __-Yes
Windows forhttprequestsintheWindowsFirewallsoftwareto
__-No
firewall allowothermachinesonyournetworktoaccessthe
server.
Ports
BydefaultTableauServerrequiresseveralTCP/IPportstobeavailabletotheserver.Seethe
topicTableau Server Portsonpage 676forthefulllist,includingwhichportsmustbe
availableforallinstallationsvs.distributedinstallationsorfailover-readyinstallations.The
defaultportscanbechangedifthereisaconflict.SeeEdit theDefault Portsonpage 30to
learnhow.
Drivers
Youmayneedtoinstalladditionaldatabasedrivers.Downloaddriversfrom
www.tableau.com/support/drivers.
What's Newand What's Changed
FindoutaboutthenewandchangedfeaturesinTableauServer:
-3-
SeetheWhat'sNewinTableauServertopicintheTableauServeronlinehelpforinform-
l
ationaboutkeynewfeatures.
SeeWhat'sChanged-ThingstoKnowBeforeYouUpgradeforinformationabout
l
changesthatmayimpactyourusers.
MinimumHardware Requirements and Recommendations forTableau Server
Thefollowingminimumhardwarerequirementsandrecommendationsapplytoallcomputers
runningTableauServer,includingphysicalhardwareandvirtualmachines(VMs):
Minimumrequirementsaretheminimumhardwareyourcomputermusthaveinorder
l
toinstallTableauServer.Ifyourcomputerdoesnotmeettheserequirements,theSetup
programwillnotinstallTableauServer.Theserequirementsareappropriatefortesting
andprototyping.
Minimumrecommendationsarehigherthanminimumrequirements,andrepresent
l
theminimumhardwareconfigurationyoushoulduseforaproductioninstallationof
TableauServer.Ifyourcomputermeetstheminimumrequirementsbutdoesnotmeet
theserecommendations,thesetupprogramwillwarnyoubutyoucancontinuethe
installation.
Inaddition,TableauServershouldnotbeinstalledonaphysicalcomputeroronaVM instance
thatisalsorunningresource-intensiveapplicationssuchasdatabasesorapplicationservers.
Note:IfyouinstallTableauServeronacomputerthatmeetstheminimumrequirements
butdoesnothaveatleast8coresand16GBofsystemmemory,thedefaultnumberof
allprocessesinstalledisreducedtooneofeachprocessbydesign.Formore
informationaboutprocesses,seeServer ProcessLimitsonpage 86
MinimumHardware Requirements
ThecomputeronwhichyouareinstallingorupgradingTableauServermustmeettheminimum
hardwarerequirements.Ifthesetupprogramdeterminesthatyourcomputerdoesnotmeetthe
followingrequirements,youwillnotbeabletoinstallTableauServer.Formoreinformationon
howtheSetupprogramdetermineshardware,see"DeterminingComputerHardware,"below.
Theseminimumrequirementsareappropriateforacomputerthatyouuseforprototypingand
testingofTableauServer.Theyapplytosingle-nodeinstallationsandtoeachcomputerina
distributedinstallation.
CPU RAM FreeDisk
Space
MinimumHardware 2-core 8GB 15GB
Requirements
-4-
Fortherequirements:
FreediskspaceiscalculatedaftertheTableauServerSetupprogramisunzipped.The
l
setupprogramusesabout1GBofspace.
Corecountisbasedon"physical"cores.Physicalcorescanrepresentactualserver
l
hardwareorcoresonavirtualmachine(VM).Hyper-threadingisignoredforthe
purposesofcountingcores.
Note: ForTableauServer10.0,youneedaminimumof2physicalcores.Ifyouare
installingonanAmazonEC2instance,thismeans4vCPUs.Formoreinformation,see
AmazonEC2Instances.
MinimumHardware Recommendations
Forproductionuse,thecomputeronwhichyouinstallorupgradeTableauServershouldmeet
orexceedtheminimumhardwarerecommendations.Theserecommendationsaregeneral.
ActualsystemneedsforTableauServerinstallationscanvarybasedonmanyfactors,including
numberofusersandthenumberandsizeofextracts.Ifthesetupprogramdeterminesthat
yourcomputerdoesnotmeetthefollowingrecommendations,youwillgetawarning,butyou
cancontinuewiththesetupprocess.
InstallType Processor CPU RAM FreeDisk
Space
Singlenode 64-bit 8-core,2.0GHz 32GB 50GB
orhigher
Multi-nodeand ContactTableaufortechnicalguidance.
enterprise
Nodesmustmeetorexceedtheminimumhardware
deployments
recommendations,exceptnodesrunningbackgrounder,where4
coresmaybeacceptable.
Determining ComputerHardware
Todeterminehowmanyphysicalcoresacomputerhas,theTableauServersetupprogram
queriestheoperatingsystem.Toviewhardwareinformationthatthesetupprogramdetected
onyourcomputer,openthetabadmin.logfileinthefollowingfolderonthecomputerwhere
youareinstallingTableauServer:
<install directory>\ProgramData\Tableau\Tableau Server-
\logs\tabadmin.log
-5-
Inthetabadmin.logfile,lookforlinessimilartothefollowing.Theselinesprovide
informationaboutthephysicalandlogicalcoresthatthesetupprogramdetectedandthatit
usedtodeterminethecorecountthatisbeingusedforlicensing.
2015-04-09 14:22:29.533 -0700_DEBUG_10.36.2.32:<machine name>_:_
pid=21488_0x2cd83560__user=__request=__ Running hardware check
2015-04-09 14:22:29.713 -0700_DEBUG_10.36.2.32:<machine name>_:_
pid=21488_0x2cd83560__user=__request=__ Detected 12 cores and
34281857024 bytes of memory
2015-04-09 14:22:29.716 -0700_DEBUG_10.36.2.32:<machine name>_:_
pid=21488_0x2cd83560__user=__request=__ Hardware meets recom-
mended specifications. Default values will be used.
Manuallydeterminingthenumberofcoresonyourcomputer
Todeterminemanuallyhowmanyphysicalcoresyourserverhas,youcanusetheWindows
ManagementInstrumentationCommand-linetool(WMIC).Thisisusefulifyoudonotknow
whetheryourcomputerwillmeettheminimumhardwarerequirementsforinstallingTableau
Server.
1. Openacommandprompt.
2. Enterthefollowingcommand:
WMIC CPU Get DeviceID,NumberOfCores
TheoutputwilldisplaythedeviceID orIDsandthenumberofphysicalcoresthe
computerhas.
Inthisexample,therearetwoCPUs,eachwithsixcores,foratotaloftwelvephysical
cores.Thiscomputerwouldsatisfytheminimumhardwarerequirementsforinstalling
TableauServer.
Thefollowingcommandshowsalongerversionthatliststhelogicalprocessorsaswell
asthephysicalcores.
-6-
WMIC CPU Get
DeviceID,NumberOfCores,NumberOfLogicalProcessors,SocketDesign
ation
Intheaboveexample,theserverhasatotaloftwelvephysicalcores,resultingin24
logicalcores.
Domain TrustRequirements
WhenyourunTableauServerinanActiveDirectoryenvironmentacrossmultipledomains
(eitherinthesameActiveDirectoryforestorindifferentforests),someTableaufunctionalityis
dependentonthetrustrelationshipbetweenthedomains.Forexample,someadministrators
manageusersindomainsthatareseparatefromwheretheydeployserverapplications,such
asTableauServer.Inotherorganizations,aTableauServerdeploymentmightbesharedwith
externalpartnersorwithdifferentpartnersintheorganization.Finally,Windows-authenticated
datasources,suchasSQLServer,MSAS,orOracle,thatTableauServerconnectstomayalso
beinotherdomains.
Ifit'sfeasible,werecommendconfiguringtwo-waytrustbetweenalldomainsthatinteractwith
TableauServer.Ifthisisnotpossible,TableauServercanbeconfiguredtosupportuser
authenticationwhereaone-waytrusthasbeenconfigured.Inthiscase,aone-waytrust
betweendomainsissupportedwhenthedomaininwhichTableauServerisinstalledis
configuredtotrustthedomainwhereuseraccountsreside.
Thefollowingillustrationshowsone-waytrustbetweenthedomainwhereTableauServeris
installedandthedomainwhereuseraccountsreside:
-7-
Inthisscenario,TableauServerisinthedev.localdomain,andusersfromtheusers.lanActive
DirectorydomainareimportedintoTableauServer.Aone-waytrustisrequiredforthis
scenario;specifically,thedev.localdomainisconfiguredtotrusttheusers.landomain.Usersin
theusers.landomaincanaccessTableauServerinthedev.localwiththeirnormalActive
Directorycredentials.However,youmayneedtoupdatethedomainnicknameonTableau
Serverbeforeuserslogonwiththenickname.RefertotheTableauKnowledgeBaseformore
information.
Kerberossinglesign-onissupportedinthisone-waytrustscenario.
ReviewUser Management in ActiveDirectoryDeploymentsonpage 683tounderstand
howmultipledomains,domainnaming,NetBIOS,andActiveDirectoryusernameformat
influenceTableauusermanagement.
Connectingtolivedatainone-waytrustscenarios
Intheone-waytrustscenario,usersconnectingtoTableauServercanconnecttolivedata
that'shostedinthecloudoronanyotherdatasourceonpremisesthatdoesnotrelyon
Windowsauthentication.
DatasourcesthatrequireWindows-authenticationmighthaveadditionalauthentication
requirementsthatcomplicatethescenario,orthatcanevenpreventTableauServerusersfrom
connecting.ThisisbecauseTableauServerusestheRunAsUseraccountforauthentication
withsuchdatasources.IfyouarerunningTableauServerinadifferentdomainthandata
sourcesthatuseWindowsauthentication,verifythattheRunAsUseraccountthatisusedfor
TableauServercanaccessthedatasource.
-8-
Run As User
TheRunAsUserisaWindowsaccountthatTableauServeruses("runsas")whenitaccess
resources.Forexample,TableauServerreadsandwritesfilesonthecomputerwhereTableau
Serverisinstalled.FromtheperspectiveofWindows,TableauServerisdoingthisastheRun
AsUser.Insomecases,TableauServermayusetheRunAsUseraccounttoaccessdatafrom
externalsources,suchasdatabasesorfilesonasharednetworkdirectory.
AsyouplanyourTableauServerdeployment,youneedtodetermineifthedefaultRunAs
User,configuredtorununderthecontextofthelocalNetworkServiceaccount(NT
Authority\NetworkService),willsufficeforyourneeds.Ifitdoesnot,thenyouwillneedto
updatetheRunAsUsertorununderadomainaccountthathasaccesstotheresourcesinyour
ActiveDirectorydomain(s).
Ineithercase,it’simportanttounderstandthesecurityimplicationsoftheaccountthatTableau
ServerusesfortheRunAsUser.Specifically,ifTableauServerneedstoaccessotherservers,
fileshares,ordatabasesthatuseWindowsauthentication,thentheaccountthatisconfigured
forRunAsUserwillbeusedtoaccessthoseresources.TheaccountthatisconfiguredforRun
AsUsermustalsohaveelevatedpermissionstothelocalTableauServer.Ageneralbest
securitypracticeistolimitthescopeofalluseraccountstotheminimumrequiredpermissions.
WemakethesamerecommendationtoyouasyouplanRunAsUser.
YousetorupdatetheRunAsUseraccountintheTableauServerConfigurationutility.The
utilitysetspermissionsfortheRunAsUser,butifyouareunsureiftheaccountyouwanttouse
forRunAsUsersatisfiestherequirements,orifyouhavechangedtheRunAsUserandare
gettingpermissionerrors,seeRequired Run AsUser Account Settingsonpage 664.
Default Run As Useraccount: Network Service
TheNetworkServiceaccountisapredefinedlocalaccountwithlimitedpermissionsthatexists
onallWindowscomputers.Whileithaslimitedadministrativeaccesstothelocalcomputeron
whichitruns,itdoeshavemoreaccesstoresourcesthanmembersoftheActiveDirectory
defaultUsersgroup.ForexampletheNetworkServicegroupcanwritetotheregistry,theevent
log,andhasspecialrightstologonforapplicationservices.
Bydefault,theRunAsUserissettoalocalaccountcalledNetworkService.Usethedefault
NetworkServiceaccountwhen:
-9-
YouareusinglocalauthenticationforTableauServer.
l
Allusersinyourorganizationincludeextracteddataintheworkbooksthattheyare
l
uploadingtoTableauServer.
YouarerunningTableauServerinasingle-serverdeployment.
l
ExternaldatasourcesthatyourusersaccessthroughTableauServerdonotrequireWin-
l
dowsNTintegratedsecurityorKerberos.Inmostdata-accessscenarios,MicrosoftSQL
Server,MSAS,Teradata,andOracledatabasesrequireWindowsNTintegratedsecur-
ity.
WhiletheNetworkServiceaccountcanbeusedtoaccessresourcesonremotecomputers
withinthesameActiveDirectorydomainwedonotrecommendusingthedefaultaccountfor
suchscenarios.Instead,configureadomainaccountforRunAsUserifTableauServermust
connecttodatasourcesinyourenvironment.SeeCreateand UpdatetheRun AsUser
Accountbelow.
Run As Useraccount: Domain user
ForallActiveDirectoryscenarios,werecommendupdatingtheTableauServerRunAsUser
withadomainuseraccount.UpdatetheRunAsUsertoadomainuseraccountwhendata
sourcesaccessedthroughTableauServerrequireWindowsNTintegratedsecurityor
Kerberos.
IfyouhavedeployedadistributeddeploymentofTableauServer,thenyoucanupdatetheRun
AsUseraccountwitheitheradomainuseroraWindowsworkgroupuser.Ineithercase,you
mustusethesameuseraccountforallservernodes.SeeDistributed Requirementson
page 128formoreinformation.
Toconfigureyourenvironmenttouseadomainaccount,seeCreateand UpdatetheRun
AsUser Accountbelow.
Create and Update the Run As UserAccount
Ifyouareoperatinginanenvironmentwhereamajorityofyourdatasourcesareauthenticated
inthecontextofActiveDirectory(WindowsNTintegratedsecurity)thenyouwillneedto
configuretheRunAsUsertouseadomainaccount,notthelocalaccount(NetworkService)
that'sthedefault.
Therearetwosteps:
1. CreatetheRunAsUseraccountinActiveDirectory
2. UpdateTableauServertousetheRunAsUseraccount
CreatingtheRunAsUseraccount
Followthesebestpractices:
CreateadedicatedaccountinActiveDirectoryfortheTableauServerRunAsuser
l
account.Inotherwords,don’tuseanexistingaccount.Byusingadedicatedaccountyou
-10-
